标题： foREST：一种基于树的模糊测试RESTful API的方法 显示英文标题

标题： foREST: A Tree-based Approach for Fuzzing RESTful APIs

摘要： 表述状态传输（REST）是网络应用和云服务中广泛采用的架构。 用户可以根据其应用接口的规范调用此类服务，即RESTful API。 现有的针对RESTful API模糊测试的方法通常基于经典的API依赖图。 然而，由于API之间的依赖关系爆炸，这种依赖关系对于REST服务来说效率不高。 在本文中，我们提出了一种基于树的新方法，可以更好地捕捉关键依赖关系，并大幅提高RESTful API模糊测试的效率。 特别是，跨多个API的端点的层次信息使我们能够构建一个API树，树节点之间的关系可以表示资源依赖的优先级，\textit{例如，}一个节点更可能依赖其父节点而不是子节点或兄弟节点。 在评估部分，我们首先确认这种基于树的方法比传统的基于图的方法更高效。 然后我们将我们的工具应用于模糊两个现实世界的RESTful服务，并与两种最先进的工具EvoMaster和RESTler进行性能比较。 我们的结果表明，foREST在所有实验中都能提高代码覆盖率，范围从11.5%到82.5%。 此外，我们的工具发现了11个之前未知的新错误。 显示英文摘要

摘要： Representational state transfer (REST) is a widely employed architecture by web applications and cloud. Users can invoke such services according to the specification of their application interfaces, namely RESTful APIs. Existing approaches for fuzzing RESTful APIs are generally based on classic API-dependency graphs. However, such dependencies are inefficient for REST services due to the explosion of dependencies among APIs. In this paper, we propose a novel tree-based approach that can better capture the essential dependencies and largely improve the efficiency of RESTful API fuzzing. In particular, the hierarchical information of the endpoints across multiple APIs enables us to construct an API tree, and the relationships of tree nodes can indicate the priority of resource dependencies, \textit{e.g.,} it's more likely that a node depends on its parent node rather than its offspring or siblings. In the evaluation part, we first confirm that such a tree-based approach is more efficient than traditional graph-based approaches. We then apply our tool to fuzz two real-world RESTful services and compare the performance with two state-of-the-art tools, EvoMaster and RESTler. Our results show that foREST can improve the code coverage in all experiments, ranging from 11.5\% to 82.5\%. Besides, our tool finds 11 new bugs previously unknown.